Overview

overview

10

Static

static

Pay-In Slip·pdf.exe

windows7-x64

10

Pay-In Slip·pdf.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2022 04:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Pay-In Slip·pdf.exe

  • Size

    346KB

  • MD5

    8d4854f7d2c0efd244648435941eac95

  • SHA1

    e2985e3ecc1ba7dd2d81ac7dba214e01dccaa9f7

  • SHA256

    6605bf5c726be2c791f0e6611b9421443e4f655e0626fe8016f3dfcfea1db057

  • SHA512

    841b5b9241e95af117176c70f829d3f7a33b2f55da68d7270a06914f609560b19b18c67bafb40c18c161db572b11dea7f5e2919e65bfbbdb10f23ed2801200fd

  • SSDEEP

    6144:V/c/43AbmhXUQirdrt9ENYoTvGfKPGneudaKPvPSYn0Zn8f4lAFRJG3wDIMq2vd6:VR37XUTrdp9SYYOfKeneudb/SY2n8fet

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pay-In Slip·pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Pay-In Slip·pdf.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:4908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1060
      2⤵
      • Program crash
      PID:1692
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4908 -ip 4908
    1⤵
      PID:1992

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nseED06.tmp\Math.dll
      Filesize

      171KB

      MD5

      499788d1d4b70ea3499b6411ef5aca0c

      SHA1

      db7274f0c3beea8a2ed7df7fe3006b1ec965d13c

      SHA256

      6b6c63505ac093672cdc062ea23ea8fbb263204c9591c936dda896cba2c56504

      SHA512

      c566e94acf0d0de820fb2e7661b721a6fd23c6c5fe7b551b48e80b3c24b0d8de379fa2c53a653858e69dd0a8f6b98bf68a6d7425342f1ade1602ddaa2310c549

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\nseED06.tmp\System.dll
      Filesize

      12KB

      MD5

      6c38da8922cc37b4bbb77de4a63ad843

      SHA1

      4e0533fd11df8bddbd543ed58df7b6060d9f4631

      SHA256

      1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1

      SHA512

      ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430

      Download Submit